The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.
A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
01 May 2026, 12:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc - Vendor Advisory | |
| First Time |
Freebsd freebsd
Freebsd |
|
| CPE | cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:* |
30 Apr 2026, 15:13
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-30 07:16
Updated : 2026-05-01 16:16
NVD link : CVE-2026-42511
Mitre link : CVE-2026-42511
CVE.ORG link : CVE-2026-42511
JSON object : View
Products Affected
freebsd
- freebsd
CWE
CWE-149
Improper Neutralization of Quoting Syntax